HN

Need help?
<- Back
Notion leaks email addresses of all editors of any public page

Notion leaks email addresses of all editors of any public page

Tiberium

Comments (65)

  • Tiberium
    Apparently this is officially documented at https://www.notion.com/help/public-pages-and-web-publishing#... buried in a note:> When you publish a Notion page to the web, the webpage’s metadata may include the names, profile photos, and email addresses associated with any Notion users that have contributed to the page.
  • lioeters
    Recently I checked back on Notion after a year or so of not seeing it. I was going to recommend it to someone as an example of hypertext, but I see now it calls itself an "AI workplace that works for you" and "Your AI everything app". This company means nothing now, seriously what happened.
  • RomanPushkin
    It has been an issue for at least 5 years. I remember one dude from HN deanonymized me around 5 years ago by looking at my notion page.
  • linsomniac
    Very timely. I literally ran a Claude prompt "compare and contrast Notion vs Obsidian" and flipped over to HN while it was thinking, and this comes up. Thanks HN!
  • DropDead
    Big companys need to start caring more security and privacy of its users and employees
  • amazingamazing
    I've been toying around an architecture that sets things up such that the data for each user is actually stored with each user and only materialized on demand, such that many data leaks would yield little since the server doesn't actually store most of the user data. I mention this since this sorts of leaks are inevitable as long as people are fallible. I feel the correct solution is to not store user data to begin with.some problems I've identified:1. suppose you have x users and y groups, of which require some subset of x. joining the data on demand can become expensive, O(x*y).2. the main usefulness of such an architecture is if the data itself is stored with the user, but as group sizes y increase, a single user's data being offline makes aggregate usecases more difficult. this would lend itself to replicating the data server side, but that would defeat the purpose3. assuming the previous two are solved, which is very difficult to say the least, how do you secure the data for the user such that someone who knows about this architecture can't just go to the clients and trivially scrape all of the data (per user)?4. how do you allow for these features without allowing people to modify their data in ways you don't want to allow? encryption?a concrete example of this would be if HN had it so that each user had a sqlite database that stored all of the posts made per user. then, HN server would actually go and fetch the data for each of the posters to then show the regular page. presumably here if a data of a given user is inaccessible then their data would be omitted.
  • georgespencer
    Notion’s macOS app is some of the worst software I’ve ever used. If there is a platform design idiom, they likely break it without a second thought.
  • e-dant
    Are security vulnerabilities good marketing?
  • VladVladikoff
    The tweet is only a few words, you really need an LLM to write that for you???
  • hohithere
    Any self hosted solution?
  • staticassertion
    Isn't this very typical? Also, what is the proposal?
  • SadErn
    [dead]